Cybersecurity can sound like a job for experts with racks of servers, but most real-world hacks against individuals and small businesses are surprisingly ordinary. A reused password leaks in a data breach. Someone clicks a convincing fake delivery text. A laptop that skipped months of updates gets hit by a known flaw.
The good news is that a small set of habits blocks the vast majority of these attacks. Agencies such as CISA, NIST and the FTC all point to the same core steps. This guide walks through them in plain English, in roughly the order that gives you the most protection for the least effort.
Start with strong, unique passwords
The single biggest risk for most people is password reuse. When one website is breached, criminals take the leaked email and password combinations and try them automatically on email, banking and shopping sites. If you reuse passwords, one breach can unlock many accounts.
Current NIST guidance favors length over complexity. A long passphrase of several random words is both stronger and easier to type than a short jumble of symbols. Aim for at least 15 characters for important accounts, and never reuse a password.
Use a password manager
Nobody can remember dozens of long, unique passwords, which is why password managers exist. They generate strong passwords, store them in an encrypted vault and fill them in for you. You only need to remember one strong master passphrase.
Most operating systems and browsers include a built-in password manager, and there are reputable standalone options that work across devices. Whichever you choose, protect it with a long master passphrase and multifactor authentication.
Clean up old passwords gradually
You do not have to change every password in one sitting. Start by letting the manager save passwords as you log in over a few weeks. Most managers then flag weak, reused or breached passwords, giving you a to-do list. Fix your email, banking and shopping accounts first, then work through the rest when you have a spare ten minutes. Close accounts you no longer use, since forgotten accounts with old passwords are easy targets.
Also be careful with security questions. Answers such as your first school or pet’s name are often findable on social media. Treat them like extra passwords: give a random answer and store it in your password manager.
Turn on multifactor authentication and passkeys
Multifactor authentication (MFA), also called two-step verification, means a stolen password alone is not enough to get in. You also need something you have, such as your phone, or something you are, such as your fingerprint.
Not all methods are equally strong:
| Sign-in method | Protection level | Notes |
|---|---|---|
| Password only | Low | Vulnerable to breaches, guessing and phishing |
| Password + text message code | Moderate | Can be intercepted via SIM-swap or phishing |
| Password + authenticator app | Good | Codes generated on your device |
| Password + push approval | Good | Use number matching; never approve unexpected prompts |
| Passkey | Very strong | Phishing-resistant, no password to steal |
| Physical security key | Very strong | Phishing-resistant; ideal for high-value accounts |
Passkeys are worth understanding because they are now widely supported. Instead of a password, your device stores a cryptographic key and unlocks it with your face, fingerprint or PIN. Because there is nothing to type into a fake website, phishing largely stops working.
Prioritize these accounts first
- Your main email account. It is the master key, because password resets for everything else go there.
- Banking, payment and investment apps.
- Your password manager.
- Social media and messaging, which scammers hijack to target your friends.
- Cloud storage and your phone’s account (the account tied to your device and backups).
Save the backup or recovery codes each service gives you, and store them somewhere safe and offline.
Keep devices and software updated
Updates are not just new features. Many fix security vulnerabilities that attackers already know how to exploit. The longer you delay, the longer you are exposed to known, published flaws.
Practical steps:
- Turn on automatic updates for your operating system, browser and apps.
- Restart when prompted, since many updates only take effect after a reboot.
- Update your router, which is easy to forget. Many newer routers update automatically.
- Replace devices that no longer receive security updates. An unsupported phone, laptop or router becomes riskier every month. If you are shopping, our guide on how to choose a laptop covers what to look for.
- Remove apps you no longer use, since each one is a potential weak point.
Also use the built-in protections: a screen lock with a PIN or biometrics, device encryption (on by default on most modern phones and many laptops), and the system’s own antivirus and firewall.
Learn to spot phishing
Phishing messages try to trick you into clicking a link, opening an attachment, sharing a code or sending money. They arrive by email, text, phone call, social media and messaging apps, and AI tools have made them more polished than ever.
Common warning signs:
- Urgency or fear: “Your account will be closed in 24 hours” or “Suspicious payment detected.”
- Requests for codes or passwords. Legitimate companies will not ask you to read out a verification code.
- Unexpected attachments or links, especially shortened links or web addresses that are slightly misspelled.
- Payment by gift card, wire transfer or cryptocurrency. The FTC notes these are favorite methods of scammers.
- A familiar name with an unfamiliar address or number, such as a “boss” texting from a new phone.
Pro tip: When in doubt, do not use the link or number in the message. Open the app yourself, type the website address you know, or call the number on the back of your card. A minute of checking beats weeks of cleanup.
Use Wi-Fi safely at home and away
At home, secure your router: change the default admin password, use WPA3 or at least WPA2 encryption, set a strong Wi-Fi password and keep the firmware updated. Consider a separate guest network for visitors and smart home gadgets.
On the go, public Wi-Fi is less dangerous than it used to be because most sites encrypt traffic, but risks remain. Confirm the exact network name with staff to avoid fake hotspots, turn off file sharing, and avoid sensitive tasks on unknown networks. Your phone’s personal hotspot is often the safer option, and a reputable VPN adds a layer of protection on untrusted networks.
Back up your data
Backups are your safety net against ransomware, theft, hardware failure and simple accidents. If an attacker encrypts or deletes your files, a recent, separate backup means you can restore them without paying anyone.
Follow the widely used 3-2-1 rule: three copies of your data, on two different types of storage, with one kept off-site or in the cloud. Make sure at least one backup is not permanently connected to your computer, so ransomware cannot reach it. Our guide to cloud storage and backups explains how to set this up step by step.
What to do if you get hacked
Act quickly, but calmly. Work through these steps:
- Secure your email first. Change its password, sign out of all sessions and turn on MFA.
- Change passwords on the affected account and any account that shared the same password.
- Check account settings for changes an attacker may have made, such as forwarding rules, recovery phone numbers or linked devices.
- Contact your bank or card provider immediately if money or payment details are involved.
- Scan your devices with built-in security tools and install all updates.
- Report it. In the US, report identity theft at IdentityTheft.gov and fraud to the FTC; elsewhere, use your national reporting service.
- Warn your contacts if your email or social accounts sent suspicious messages.
- Consider a credit freeze if your personal or financial details were exposed.
Small businesses should also notify their IT provider, review who has admin access, and check whether any data breach notification rules apply in their location.
The bottom line
You do not need to become a security expert. Install a password manager, turn on MFA or passkeys for your email and bank, switch on automatic updates and set up a backup. Those four steps alone put you ahead of most attackers’ easy targets.
Then build the habit of pausing before you click. Pick one item from this guide to do today, and another next week. Security is a routine, not a one-off project, and every step makes you a harder target.
